The omap_mpuio_driver was mistakenly registered within the omap_gpio_probe callback. Because the driver core enforces a device lock during probe, this violates the contract and can cause a deadlock when the module is loaded. Additionally, the driver is never unregistered on module exit, leading to a persistent resource leak. Together, these flaws allow an attacker to freeze the system or degrade performance over time, addressing CWE-667 and CWE-833.

The issue exists in all Linux kernel versions that predate the commit relocating omap_mpuio_driver registration to module init and adding an unregister handler in module_exit. Any system running the OMAP GPIO subsystem and capable of loading the affected driver is at risk.

EPSS indicates a very low current exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local or privileged access to load or unload the kernel module, so the attack surface is limited. Nonetheless, once the module is loaded, a deadlock can be triggered immediately and the lingering resource leak can affect system stability over time. The CVSS score of 5.5 indicates a moderate severity. Overall risk remains moderate to high depending on exposure to kernel module loading.